Malicious PDF — malware analysis report

Static analysis result for SHA-256 971ee9bde789cc80…

MALICIOUS

PDF

72.7 KB Created: 2021-04-02 14:07:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c22e795889f23cb083b555a58b7b1821 SHA-1: 90e13d389bec59b65745da50ac65ded4120bc062 SHA-256: 971ee9bde789cc808aa718ffc631ade78cc107a9784c12c82f4b4a3ef9cb3d70
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, many of which point to other PDF documents, suggesting a link farm or redirection mechanism. One prominent URL, 'https://jumiwimov.ru/wix?keyword=eureka+math+grade+4+module+1+lesson+7+answer+key', appears to be a lure for educational content. The presence of ClamAV detection and ML classification flagging this PDF as malicious further supports its suspicious nature. While no scripts were explicitly extracted, the PDF structure and extensive external linking are indicative of a phishing or content-luring attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=eureka+math+grade+4+module+1+lesson+7+answer+key
    • https://static.s123-cdn-static.com/uploads/4417429/normal_5fc7972661a1c.pdf
    • http://ericksandoval.com/how_to_record_accrued_interest_journal_entrybzstj.pdf
    • http://canonsburglake.com/how_to_poach_eggs_in_nordic_ware_egg_poacherovpqw.pdf
    • http://kulilezew.iblogger.org/character_education_worksheet.pdf
    • https://static.s123-cdn-static.com/uploads/4412607/normal_5ffd47d59932d.pdf
    • http://naturka.space/the_way_up_to_heaven_by_roald_dahl898j0.pdf
    • https://static.s123-cdn-static.com/uploads/4480155/normal_5ffb3f7154434.pdf
    • http://about-central.com/75313527200lulb7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gowebabuxogiro/icao_full_form.pdf
    • https://a4346b84-4611-49ab-b113-80c9188ca613.filesusr.com/ugd/078c79_c4b655ff94bb467ab1e20c4c1979a046.pdf?index=true
    • https://7a3463bf-3117-47cc-940f-ad9d50d05675.filesusr.com/ugd/9f2514_f4e9ea4d53ed446dac91344ba15ecfc6.pdf?index=true
    • https://s3.amazonaws.com/zobuwubedak/59110454463.pdf
    • https://s3.amazonaws.com/potamotaz/35022738922.pdf
    • http://vurorawoguw.rf.gd/windows_small_business_server_2011_standard_iso_download.pdf
    • https://s3.amazonaws.com/wiremeresegikon/pulokedapozinoxu.pdf
    • https://e97408dc-4b05-4e3b-9f19-f4127feb49ef.filesusr.com/ugd/a42eed_4ac3f2e3a66040fc95dd9942c9b5b2a5.pdf?index=true
    • https://s3.amazonaws.com/jifedefujodu/nomat.pdf
    • https://s3.amazonaws.com/woneketelak/sufopuzexemowuvupivekego.pdf
    • https://s3.amazonaws.com/fukepez/five_great_dialogues_plato.pdf
    • https://ac6a5e95-3fab-4d4b-a7e7-0ef4c71e5929.filesusr.com/ugd/32c278_3a03b0c951a84d19bd4bfa1f6635c830.pdf?index=true
    • https://s3.amazonaws.com/bejikefowu/96651392853.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd62.bin
c9670e9fccc1ef073f62aed33538e389999ad219bad44f5d1730b83569b0f8f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD62 5676 bytes
font_01_sfnt_off0000f0ba.bin
94e0c32c983b5a25a95067242821b17d131a5a8258c2d9e0bb3bc8377489f1e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0BA 10672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.